Junos OS on SRX: stack overflow in UTM Anti-Spam SBL lets a malformed DNS reply run code as root

CVSS 9.2CVE-2026-101955Firmware, BMC & network fabriccurated

Impact

When UTM Anti-Spam SBL inspection is enabled, the SRX performs blocklist lookups over DNS, and an injected malformed DNS packet overflows a stack buffer, allowing arbitrary code execution or a denial of service. The attacker does not need credentials, but does need to get a forged or malicious DNS response in front of the device, which the CVSS vector reflects as attack requirements present (AT:P). Code execution here lands inside the firewall that terminates the perimeter for the fleet behind it, so the result is the same as any other root-on-firewall outcome: policy bypass and traffic visibility across tenants.

Who can reach it

Network, unauthenticated, with a precondition: the attacker must be able to inject or control the DNS response the SRX receives for an Anti-Spam SBL lookup - an on-path position or a compromised resolver. Only devices with UTM Anti-Spam SBL inspection enabled are exposed.

What to do

Upgrade Junos OS per Juniper advisory JSA112186; fixed releases are not in the NVD record, so read the bulletin. As a configuration mitigation, disabling UTM Anti-Spam SBL inspection removes the vulnerable path, and pointing the device at a trusted resolver over a protected path narrows who can inject responses. The upgrade itself requires a chassis reboot and a maintenance window or HA failover.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-101955 https://supportportal.juniper.net/JSA112186

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.